Examine the details surrounding Azure DevOps Secure Files

Examine the details surrounding Azure DevOps Secure Files

In Azure DevOps, Secure Files provide a way to securely store and manage sensitive files (e.g., certificates, keys) required during the execution of your pipelines. These files are encrypted and only accessible by authorized users or pipeline jobs. Here’s how to upload, manage, and use secure files in YAML pipelines.

1. How to Upload Secure Files

To upload a secure file into Azure DevOps, follow these steps:

Steps to Upload Secure Files:

1. Navigate to the Azure DevOps Project: Go to your Azure DevOps project where you want to upload the secure file.

2. Go to Project Settings: In the bottom-left corner of the project, click on Project Settings (the gear icon).

3. Access Secure Files: Under the Pipelines section, click on Secure Files.

4. Upload Secure Files:

   • Click on the + Secure file button.

   • In the dialog box, select the file you want to upload (e.g., a .pfx certificate, .pem SSH key, or any sensitive document).

   • Once selected, click Upload to upload the file securely.

The file will be stored encrypted in Azure DevOps and can now be used in your pipelines.

2. How to Manage Secure Files

Managing Permissions for Secure Files:

To ensure that only authorized users or pipelines can access secure files, you can manage permissions:

1. Go to the Secure Files Section: Navigate to Project Settings → Pipelines → Secure Files.

2. Select a Secure File: Select the secure file you want to manage.

3. Manage Permissions:

   • Click on the ellipsis (three dots) next to the secure file and choose Manage permissions.

   • Set permissions for users or groups (e.g., who can download or manage the file).

By default, only Project Administrators can access Secure Files, but you can grant access to specific users, service accounts, or build/release pipelines.

Audit Access to Secure Files:

Azure DevOps keeps track of who accessed or modified secure files through the Audit Logs:

1. Go to Project Settings → Security → Audit Logs.

2. Filter by Secure Files to view logs of access and modifications related to your secure files.

3. How to Use Secure Files in YAML Pipelines

Once you have uploaded the secure files, you can reference them within your YAML pipelines.

Using Secure Files in YAML Pipelines:

To use secure files in your pipeline, you will use the DownloadSecureFile task. This task will securely download the file and make it available for use in subsequent steps.

Basic YAML Example:

xxxxxxxxxx
16
1
trigger:
2
- main
3
pool:
4
  vmImage: 'ubuntu-latest'
5
jobs:
6
- job: UseSecureFiles
7
  steps:
8
  - task: DownloadSecureFile@1
9
    name: downloadCert
10
    inputs:
11
      secureFile: 'my-certificate.pfx'  # Name of the secure file you uploaded
12
  - script: |
13
      echo "Certificate downloaded successfully"
14
      # Use the downloaded file in subsequent tasks
15
      # Example: Import certificate, use in deployment, etc.
16
    displayName: 'Use Secure File in Deployment'

In this example:

1. DownloadSecureFile@1: The task used to download the secure file (in this case, my-certificate.pfx) from the secure files storage.

2. secureFile: The name of the file you uploaded in Azure DevOps (ensure it matches the file name exactly).

Accessing the File After Download:

1. By default, the secure file will be downloaded into a directory under the $(Agent.TempDirectory) variable, which you can access later in the pipeline.

2. For example, if you want to use the downloaded file in a script step (e.g., to import a certificate), you would reference the path like this:

xxxxxxxxxx
2
1
$CERT_PATH = "$(Agent.TempDirectory)/my-certificate.pfx"
2
echo "Certificate is located at $CERT_PATH"

This makes it easy to use the file in subsequent deployment steps, such as adding it to a certificate store, or using it for signing or authentication.

4. Clean-up: Delete Secure Files After Use

Azure DevOps does not automatically delete secure files after a pipeline run, so if you want to ensure the file is cleaned up, you can either delete it manually after use or configure pipeline steps to delete files as needed.

Steps to Delete Secure Files Manually:

1. Go to Project Settings → Pipelines → Secure Files.

2. Select the file you wish to delete and click the Delete button.

3. Alternatively, if you need to delete the secure file programmatically within the pipeline after use, you can add a script step to delete it from the system, though this is typically unnecessary since the file is only downloaded temporarily for the duration of the pipeline run.

xxxxxxxxxx
4
1
- script: |
2
    echo "Deleting downloaded certificate file"
3
    rm -f "$(Agent.TempDirectory)/my-certificate.pfx"
4
  displayName: 'Delete Secure File'

5. Best Practices for Using Secure Files in Azure DevOps

1. Limit Access: Only allow access to secure files by users, groups, or pipelines that require it. This minimizes the risk of unauthorized access.

2. Use Secure Storage for Sensitive Files: Secure files should be used exclusively for sensitive data that cannot be stored in plain text or version control (e.g., certificates, private keys).

3. Avoid Storing in Repositories: Never commit sensitive files like .pfx certificates, .pem keys, or passwords to source control repositories. Use Azure DevOps Secure Files instead.

4. Audit Logs: Regularly check audit logs to monitor who accessed secure files and when. This helps ensure compliance with security policies.

5. Temporary Use: Secure files are only needed during pipeline execution. Ensure they are downloaded only when required and are not lingering in the pipeline environment longer than necessary.

6. Encryption: Azure DevOps automatically encrypts secure files in storage, so always ensure you're using the built-in functionality for managing certificates or keys rather than manual encryption/decryption procedures.

Summary

By using Secure Files in Azure DevOps, you can securely manage sensitive files (such as certificates, SSH keys, and service account credentials) and integrate them into your YAML pipelines. The DownloadSecureFile task makes it easy to use these files securely during the build, release, and deployment processes.

Following best practices around file permissions, access control, and clean-up will help keep your sensitive information secure and your pipelines efficient.